Sign MSIX files with SignTool (workaround solution)

SignTool 64 bit currently cannot sign unsigned .msix files when used with Signing Manager Controller (SMCTL). This limitation stems from the way SignTool handles .msix packages that use certificate-based signing through a Key Storage Provider (KSP).

Nota

To sign MSIX files with 32 bit signtool using office SIPs, see sign with third-party signing tools.

As a workaround, you can use the open-source sign tool provided by Microsoft.

Nota

This tool works only on Windows and with RSA keypairs.

exemplo 1. Powershell

Install the tool:

dotnet tool install --tool-path . --prerelease signSome code

Obtain your certificate fingerprint (SHA-256):

(openssl x509 -noout -fingerprint -sha256 -in rsa_endentity.crt).Split('=')[1] -replace ':',''

Sign the .msix file:

sign code certificate-store \
  -cf Path\to\rsa_endentity.crt \
  -td sha256 \
  -csp "DigiCert Signing Manager KSP" \
  -k yourKeypairAlias \
  -cfp yourSha256FingerprintString \
  Path\to\YourApp.msix

To download end entity certificate, see manage certificate or download certificate.

exemplo 2. Bash

Install the tool:

dotnet tool install --tool-path . --prerelease sign

Obtain your certificate fingerprint (SHA-256):

openssl x509 -noout -fingerprint -sha256 -in rsa_endentity.crt | cut -d '=' -f2 | sed -s s/://g

Sign the .msix file:

sign code certificate-store \
  -cf Path\to\rsa_endentity.crt \
  -td sha256 \
  -csp "DigiCert Signing Manager KSP" \
  -k yourKeypairAlias \
  -cfp yourSha256FingerprintString \
  Path\to\YourApp.msix

To download end entity certificate, see manage certificate or download certificate.

Nesta secção: